Warning:The check of ... looks like it was orphaned ...

This support forum board is for support questions relating to Nagios XI, our flagship commercial network monitoring solution.
Locked
sholdings
Posts: 21
Joined: Mon Jun 14, 2010 10:44 am

Warning:The check of ... looks like it was orphaned ...

Post by sholdings »

Hi,

We are running into a very strange issue today and yesterday. There are many many many warning message like this. It is over than 10 MB message are something like followings. What cause that? How can we avoid this happen again. We have experienced this twice this month.

Warning: The check of service 'Linux Process Usage' on host 'wms.sm1......com' looks like it was orphaned (results never came back). I'm scheduling an immediate check of the service..
.

Thanks
mmestnik
Posts: 972
Joined: Mon Feb 15, 2010 2:23 pm

Re: Warning:The check of ... looks like it was orphaned ...

Post by mmestnik »

This may have to do with multiple instances of Nagios Core running. We are looking for a detailed report on this situation, as it's not something we can reproduce in a lab.

Code: Select all

script output.log
ps l $(pgrep nagios)
for ech in $(pgrep nagios); do gcore -o nagios.$ech $ech; done
exit
tar -cjvf sendtous.tar.bz2 output.log nagios.*
This file will most likely contain sensitive information, please arrange for us to get a copy of sendtous.tar.bz2 privately. Afterwards you can kill of the daemons("killall -9 nagios") and start them up from the web interface.
sholdings
Posts: 21
Joined: Mon Jun 14, 2010 10:44 am

Re: Warning:The check of ... looks like it was orphaned ...

Post by sholdings »

Thanks a lot. Yes. There are multile instances of Nagios Core running. Deleting those nagios insance wih ppid=1 then starting it up is actually fix the problem.

We have observed from our lab, if you have ever failed in restart or locked pid is not matched to the pid current run. The multiple instance nagios will happen when you do another restart from web GUI.
mmestnik
Posts: 972
Joined: Mon Feb 15, 2010 2:23 pm

Re: Warning:The check of ... looks like it was orphaned ...

Post by mmestnik »

I'm not 100% sure I understand what you are trying to say.

I'm curious as to what parent process other then 1(init) a Nagios Daemon might have? Nagios does fork/exec so for hopefully short instances(and during embedded perl) there would be more then one process called Nagios even though only one of them is an instance of "the" Nagios Daemon.

If the nagios pid file does not contain the pid of the currently running nagios daemon, then this would cause multiple instances to be run. The pid file is used to track the currently running instance of Nagios. Using process/application name to determine this might introduce DOS attacks, where a user starts a program called nagios just so the real application won't ever start.

We would need to identify when and why this happens.
Locked